Remote Access: improve back off behavior and error messages

server/remote/tunnel.go

@@ -16,6 +16,13 @@ import (
 	"github.com/hashicorp/yamux"
 )
 
+// bad registration token or sponsor token
+var errCredentialsRejected = errors.New("remote access rejected")
+
+const configRetryInterval = 15 * time.Minute
+
+const minUptime = 5 * time.Second
+
 // Tunnel manages a WebSocket+yamux tunnel to the cloud proxy.
 type Tunnel struct {
 	tunnelURL     string
@@ -63,27 +70,44 @@ func (t *Tunnel) run() {
 			t.log.ERROR.Printf("tunnel: %v", err)
 		}
 
-		// reset backoff after successful connection
+		// reset backoff only after a session that stayed connected
 		if ok {
 			bo.Reset()
 		}
 
+		wait := bo.NextBackOff()
+		// rejected credentials will not self-heal; retry slowly
+		if errors.Is(err, errCredentialsRejected) {
+			wait = configRetryInterval
+		}
+
 		select {
 		case <-ctx.Done():
 			return
-		case <-time.After(bo.NextBackOff()):
+		case <-time.After(wait):
 		}
 	}
 }
 
 func (t *Tunnel) connect(ctx context.Context) (bool, error) {
-	conn, _, err := websocket.Dial(ctx, t.tunnelURL, &websocket.DialOptions{
+	conn, resp, err := websocket.Dial(ctx, t.tunnelURL, &websocket.DialOptions{
 		HTTPHeader: http.Header{
 			"Authorization":   []string{"Bearer " + t.token},
 			"X-Sponsor-Token": []string{sponsor.Token},
 		},
 	})
 	if err != nil {
+		// rejected before the websocket upgrade; resp carries the HTTP status
+		if resp != nil {
+			switch resp.StatusCode {
+			case http.StatusConflict:
+				return false, errors.New("another evcc instance is already connected with these credentials")
+			case http.StatusUnauthorized:
+				return false, fmt.Errorf("%w (access revoked or sponsor token missing)", errCredentialsRejected)
+			case http.StatusForbidden:
+				return false, fmt.Errorf("%w (sponsor token invalid or expired)", errCredentialsRejected)
+			}
+		}
 		return false, fmt.Errorf("websocket dial: %w", err)
 	}
 
@@ -99,6 +123,7 @@ func (t *Tunnel) connect(ctx context.Context) (bool, error) {
 	}
 
 	t.changeState(session, nil)
+	start := time.Now()
 
 	// accept streams from the proxy
 	srv := &http.Server{
@@ -109,7 +134,8 @@ func (t *Tunnel) connect(ctx context.Context) (bool, error) {
 		t.changeState(nil, err)
 	}
 
-	return true, nil
+	// only a sustained connection resets backoff; an instant close keeps backing off
+	return time.Since(start) >= minUptime, nil
 }
 
 func (t *Tunnel) changeState(session *yamux.Session, err error) {